Still Cyber Podcast Ep 01 – Why Cybersecurity’s Next Phase Depends on Collaboration, AI, and Political Will

Hey everyone, it's Alan Shimel And Mitch Ashley. And you are listening to Still Cyber Still Cyber Still Cyber After All these Years. After all these years.

Oh my God, that's crazy. You know, A little play Mitchell and I started doing our First Security podcast was called Still Secure After all these years. 'cause we didn't have cyber then.

But you know what, this is a, a, a remake kind of. It's, it's called A Rag in Hollywood, Mitch Reboot. It's a re Reboot, a reboot.

And, but also, you know what? Cyber's cool. And, and you know, we both do a lot of podcasting, Mitch and videos, but it's good to talk security a little bit.

So we're gonna be doing this. I can't promise you it's gonna be the Tuesday of every week, but Mitchell and I are gonna try our best to make sure we, uh, we do it regularly. Mitch, what do you wanna talk about today?

Well, very timely here. It's the week of AWS, but we wanna talk about this, uh, letter that came from companies like Cisco, CrowdStrike. A number of companies wrote, wrote Congress, wrote, wrote the president, really the White House, and said, Hey, you're back.

Congress is back. Mitch's words, get your butt back in gear on cyber here. You know, we are, we're, we've fallen behind during this whole shutdown.

And actually, um, uh, the Democrats, I think it was wrote to, uh, Christie Nome and said, you need to get CSA back together, rehire these people. Industry is concerned that we're, we've, we've taken our eye, not only off the ball, but left, took our hands off the wheel for however many days this happened. Well, to be fair, I don't think it was just the shutdown, Mitch.

Hmm. I think that this admin, and, and I don't wanna get into a Republican Democrat thing in all honesty, but I think it's fair to say that this administration has, whether it was because of Doge or Dodge, whatever they called it, um, or what, whatever they have depressed, you know, depreciated the, uh, the cyber function in government at a time when we should have been investing more in it. We, we were really cut it down.

Um, and, and here's my reason for it. Look, I'm not, I always considered myself a centrist to say I'm not on the far right or the far left. But I think that there are certain functions that the government, you need government involvement.

Defense is obviously one, a big one. Um, but then big projects like going to the moon, right. Would, would, would you ever have gone to the moon had it not been a government program?

Um, I think cyber has become one of those projects, Mitch, where it's too big for any one company, any one industry, anyone vertical. It's, it's actually too big for the government alone too. I, I think optimally we need a government, business people partnership for, for us to have any hope of, of standing up to an increased, you know, attack surface.

When you talk about nation state. Well, I mean, well, let's go go back a few years. Homeland Security, right?

That was formed because they're nine 11. Yes. Getting the, uh, different agencies working together, communicating more free flow of information, which is a lot of what CIS o has been about, which I believe was tucked under Homeland Security.

Yes. Uh, under Christie Nome. And, uh, you know, that's about also not only in the government, but also with the public sector, public private sector, uh, communicating, working together, you know, the FBI efforts that we've had over the years.

Those, those things I think have been helpful, but suddenly we're swung the pendulum toward, well, let's have private do it. Okay. You might believe that's, well, we're gonna Private on their own to do it.

Yeah. But in the meantime, you create a vacuum by wiping everything out. It, It's too big for just a private, uh, you know, and it, and you mentioned cser.

It's not just cser to be fair. Mm-hmm. It's mire, it's nist, it's, it's, you know, there were these, they're kind of quasi-governmental agencies that are involved there.

But I, I think, but let's get to the nitty gritty, Mitch. Right. 'cause we, we are trying to keep these to 20, 25 minutes.

We're faced with a situation right now where the bad guys, whether they be nation, states, financial, hacktivists, extremists, whatever, they're using ai Oh, absolutely. And they've upped their game, whether it's using AI to write malware, to write better phishing, to, to just be more evil Or even accelerate the velocity at which they're doing Absolutely. Not just attacks, but new The velocity and the quantity.

It's like a, an exponential, you know, X two. Mm-hmm. And, um, at, at that very moment is not the time to start breaking down the fundamental infrastructure that we've built up that look has, has been responsible for things like SBOs.

Right. I don't know if you're, I'm friends with Alan Friedman on Facebook, so I, you know, Yeah. I've been a podcast with him and Yeah.

I mean, Alan kind of is the father of SBOs, but it's not just he who left csa. Basically, that whole SBO team is gone. Um, you know, that's one, one instance of it.

That's the, the, the stuff around the CVE database and what we're doing there, But which is the Mitre part. Yeah. Yeah.

And, and, you know, and again, MITRE iss a quasi-governmental thing, but they, they need support from the government. Mitch, there, there comes a point where you have to have the political will and I, I give credit to the eu. You could say what you want about the eu.

Mitchell, do you agree, disagree with the rules and regulations? They're ululating. I don't agree with all of them, but at least they have the political will to do it.

Right now, I feel we are paralysis by analysis and, and a lack of will to, to say we're gonna do something. I Feel like we're adrift. Yeah.

Like we Are, we don't have a, we don't not don't have enough direction. We have a steering wheel. Yeah.

What direction to take. You know, I was talking, you know, my days, Mitch, my days often start with my first interview being about 8 30, 9 o'clock eastern time with an Israeli cyber company. Mm-hmm.

Take your pick. There's only a thousand of them, But, uh, new every day. Yeah.

There's a new one every day line. I think they weighed outside of 8,200 and just signed them as they, you know, they hand in their next retirement papers. Come on in.

But anyway, I was talking to, uh, CEO of a company that recently came outta stuff, you know, and of Israel cyber scene. And, and he was talking about the attack surface that AI brings to this and, and threat intel. Right.

Because if you don't think the bad guys, the bad guys are using AI for th in essence, their version of threat intel reconnaissance. Mm-hmm. And if, if you are a, a company out there and you are not using this, I, I don't, I honestly, I don't know what, I don't know how you could not be a victim at this point.

I mean, it's, you know, the stakes have come up. We need a public, private, uh, partnership to, to do this. Well, what do you, what do you think it is?

I mean, I, I see, okay. So the, the private sector sends, you know, letters and we want you to do more. We want you to bring this back.

The Congress, whichever side you pick, decides they don't like something, they write an agency. We need to do this. We need to do this better.

It seems to me it's a leadership gap, not just a, we need to do more gap. Somebody has to step up and say, not saying it has to be the president, or it has to be the head of somebody has to take that mantle and say, we need to do the following things. Let's build a coalition of public, private, of the Willy Nonpolitical, whatever it is.

Actually Better coalition, better of the, it's done that way. Oh, absolutely. That It just doesn't become some big, you know, governmental overhead thing or some for-profit only, but kinda leaves out other things.

Well, you know, just between you and I, Mitch No. Yeah. Nobody, Nobody.

Nobody's listening. Yet. This is a reboot.

Most of the leadership has, has left the building. Right. The last person turned out the lights.

And, and so anyone who has the, the, um, industry knowledge, you know, the, the technical knowhow has probably, you know, recalled in horror. But it, it, it comes down to political will and priorities. When you're at a, you know, and I, I'm not mentioning names, but about two months ago I interviewed a fellow, I think his last name was Bellini.

I am mentioning names. And this fellow and his brother, I interviewed them both. They sold a company for a couple billion dollars.

And like every university, every at, at the University of South Florida, there's the Bellini School of Cyber and ai. Interesting. And if it's not Bellini, it's something that sounds like Bellini, I apologize.

Um, and he is set up a whole fund to set up like an incubator for cyber companies, basically in the Tampa area. That's a great idea. Yeah.

I brought this up to him. 'cause here is a guy, he actually, and again, I don't care whether he Republican or Democrat, but he's actually in good with the administration. Uhhuh.

He, he writes big checks, all the Better. You know, I asked him about this, Mitch, and you know what he told me? He said, well, you know, CS a had a pretty big budget.

I don't know if we were getting banged for the buck with that budget. Maybe there's better ways of spending that money that'll give us, now, I, I questioned him further on it. His thought is the companies he's investing in, in his incubator could provide that service.

Why do I want the government to do it? And and to your point earlier, that's that It's a whole philosophy. Right?

Right. Let the private sector do it. But you and I have been in security a long time.

Some startup coming out of 8,200 in Israel or the University of South Florida, they're not gonna solve these big issues that we need. No. And today's darling startup company is tomorrow's acquisition, which tomorrow's may or may not fail.

And it's, you know, integration into Broken omelets. Yeah, yeah. Broken exit Omelet.

So it could be gone tomorrow. We could be left holding the bag again. But you know what, Mitch, we're out here at AWS reinvent.

Security is on, you know, it's not a a back room thing. It's front and center. Certainly.

Um, Well, let me, let me throw this out to you. I think, I think something the government could do is create an environment for innovations, fund tax benefits, helping entrepreneurs invest in companies. Great.

Let's, Let's, they get to own a piece of the action. Well, I, that's model Case. Some that are doing that.

I wasn't gonna suggest that, but I, you know, that that could be part of the game or is part of the game, whether you, I don't know. I agree with it, but my point being, it doesn't have to be a government agency that's running it. And it's all in inside the government.

No, it doesn't have to be current government partnering with current companies. It can be us as taxpayers helping invest in what entrepreneurs don't want to do, which is great, great companies and great technology. So, again, I, I'll keep my sense roots.

Am I tilting at windmills here? No, no. You're not tilting at windmills, Mitch.

But, but you know, I was a poli sci political science. I, I remember. So what's the goal?

That good Catholic School upbringing? Yeah. St.

John's. Yeah. St St.

Vincent DePaul. Pray for us. But anyway, um, what's the role of government here?

I don't even need the government investing in these companies. You know what, there's plenty of venture capital. There's a lot of money.

Yeah. I think the role of government here is to set priorities and policies and direction. Well, that's the leadership.

That's the role of I Agree with that. And if they would set up, you know, we used to back in the day, remember what the government's, you know, when we had governments that actually worked, what was always the government's, uh, response to anything that happened. We're gonna set up a blue ribbon panel.

Oh yeah. Right. We're gonna have a blue ribbon panel of the Years later.

Yeah. The best and the brightest. But The report comes out.

Well, if you're lucky, was only that thick. But, but you know what, Mitch, all kidding aside, those blue ribbon panels often did bring together the best and the brightest and private and public. And, 'cause here's another place that I think we're lacking in our university system.

It was, is the envy. I think it still is, but it certainly was the envy of the world. Innovation can come out of our university labs Absolutely.

As well, which are government and private funded. However, our university systems and labs and all this are also under fire, under this current kind of way of looking at it from gov, you know, government's role in all of this. And when you're cutting funds and cutting students who are the lifeblood of a lot of these programs, again, you're, you're chopping 'em off at the, you're knee capping 'em.

Mm-hmm. And, uh, so I think that's a third stool for this, or a third leg of this stool. Right.

There's private government and, and educational university kind of, uh, resources we need. Mitch, here's the thing though. The building's burning down.

We, we need those first responders. We need the fire department. We need to be doing something.

Um, here's another thing though. I, and I realize we're running low on time, but what do you think about this? The idea of go hire those people back.

You think they're gonna go back? There might be a few who really are, you know, they're in it, in, into being into those kind of jobs and maybe some work that you can only do that way. I could see some people going back Policy wonks.

Yes. And people who are just, you know, I, I want to be in a service kind of role. Yeah.

Type job. And, you know, God bless 'em for doing that. So a lot of folks have, you know, maybe broken out, hopefully gotten jobs and making a lot more money and said, Hmm, this ain't bad either.

Maybe it's better. I'm probably not gonna go back to doing what I was trying. And that's my point, is you can't turn back the clock and put the genie back in the bottle.

I, I think, you know, these are bold new times with bold new, with bold new times, with new threats. And we need bold new ideas and bold new people to, to handle this. I, you know, I'm not, we don't need to set up the Peace Corps, but we need, you know what I mean?

We need that kind of movement. We do have to rethink security. Right?

Yeah. In many ways it's a different time than firewalls. And, and, uh, and load balancers and XDR, whatever the latest thing, Look, there are still plenty of lands out there that need those.

It's funny, I was talking to someone where was, I was at an event in Brooklyn at that AI native dev conference. Mm-hmm. A lot of good things to say about this.

A lot of Good stuff. And I was talking to someone there who actually started with net screen. Mm-hmm.

Remember net screen firewalls, that Juniper board. Mm-hmm. Yeah.

The, what was it? The, the, the Y brothers who then started Fortinet. Look, there was a lot of, there was a lot of hay made around firewalls and, and that it was a big deal.

Moton Castle. But you're right. We, you know, that's not tomorrow's cyber solutions.

I I, yeah. I, I'm a firm believer that tomorrow's cyber solutions, you need AI to fight ai. They've gotta be AI and power.

Well, you know, the kind of the, the good and bad of it is we don't have those things in place. We're, we're introducing a whole new agent fabric and AI data fabrics and all kinds of stuff of which, you know, let's not make the same mistakes we've made before. How do we build security into this?

And industry is responding. It's, it's happened slowly. Some good open standards have happened and they're adding more security into MCP and HUA and things like that.

But also, like we're, we're at reinvent this week. They're announcing, you know, an a a s ai, AWS security agent. Yes.

Um, they're also introducing more, um, implementation of security policies as part of the agent fabric or agent control plane, if you will. Other companies are doing that. It's not that it isn't getting addressed.

Is it the right set of things? And are we just, are we nibbling at the edges? Are we really solving the next architectural challenges around ai?

I think that's the issue. And can I be perfectly honest? Let's be honest.

Joan Rivers. Yeah. Can we talk, Look at this stage of the game, from what I hear in people and what I see, most AI agents suck.

They just don't work yet. It's early. It's Early.

It's early. It's early. See early.

I'm gonna give you the Midwest. Yeah. That's nice.

You know, it's funny, you, we, I got off the plane in Vegas today, and I, I think it was Databricks. Ha. You know, every, all the companies have neon.

Oh yeah. They're all Datadog Databricks. Yeah, exactly.

But, but Databricks had one that says, finally an AI agent. That doesn't suck. I give him credit for I Good.

Whoever did that at Databricks was probably AI who came up with it. But it was a good, it was, it was a true thing. I I think we're seeing it as a sales force.

Mm-hmm. Right. Uh, Benny often then put a lot of money into this agent force.

I don't know if it's caught people's fancy yet. Well, there, there's that view of it. There's also, we'll see if it turns, I think 2026.

We'll see. It's either gonna be real or not. I mean, can we go another year of No, this, it's Linux on the desktop, but it isn't quite ready yet.

It could be the year. This could be the year of agents. This could be the year Get real.

I think, I think it's gotta gotta be proven some value. And there are some studies that are showing that people are seeing good things from it. So it's not all, you Know.

No, it, it's not all the MIT study. No. But, um, It's not, But you know, I'm looking forward, Mitch, in a few months now, three months from now or so, a little more.

We'll be an RSA conference in San Francisco, and I think we'll get a chance to see sort of state of the mm-hmm. State of the state, if you will, of, of the security industry. Um, I think it is gonna be a lot of AI agent especially.

Yeah. Um, and we'll see how, you know, how well they're catching on. I, I think another area that I, I'm, I'm heartened to see is an increased emphasis on risk.

Mm-hmm. And risk management. And risk operations.

A holistic view and Yeah. Yeah. Again, something that the government could help with.

Mm-hmm. You know, bringing it back. Anyway, Mitch, we probably did our 20, 25 minutes here.

Um, just for people who stayed on this long though, give them what's your take on, on, uh, reinvent this week with, and the resident relates to Security? It's the beginning of it. So we're, we're taping this at the beginning of, on Monday of, of the event.

It really kind of starts tomorrow. So. Well, That's what, you're an analyst you're supposed to Yes.

But I can tell you all what's gonna happen. That's what I thought. Because I do predict the future.

That's right. No farther than two days in advance of the conference. 'cause that's all the preview, That's the only previews you've done.

Okay. Yeah. No, it's, we're, we're gonna see a, we're gonna hear a lot about frontier agents, which basically are longer running, maybe even multi-day running, having much more complex multiple models.

Uh, higher kind of in DevOps in operations, in, uh, security as well. So in a way, in a way, it's good. It's also a, now we're sort of whitewashing the frontier name, right.

'cause Frontier meant and model really kinda leading edge, bleeding edge here. Maybe that's the newest thing. I'm not sure if it's bleeding is as much as it is.

How do you get, how do you use models in a practical Sure. And some, uh, some things around being able to control what the outcomes are. So here's the boundaries, not just for security, that's part of it, but also what are the expected results coming out of an agent?

So you can say, yeah, that's off base. How do we curve that back in to try to get more accurate, higher, you know, higher responses, accurate response rates. From that, we're gonna hear, uh, about building your own models.

But rather than taking the open source o open weighted models, being able to use some of Amazon's models and using your own data, essentially creating your own trained models. Mm-hmm. Using theirs as the base.

Uh, so you hear a lot about that. There's, um, there's kind of a lot of pieces around sporting that. I think that those are the two big things that I've seen so far, I would say.

Yeah. Are they really super big things? I mean, there's, you know, It's evolutionary.

We're revolutionary And we're in this period of, you know, it's, this isn't the marathon. This is the, you know, we're at the quarter mile. We're at the one mile mark.

We're at the two mile mark. Well, it's, yeah. It's like the Kentucky Derby and, and you, you want to be coming down the stretch.

Right. But I, I do think it, it, you gotta remember this is a long term game. Mm-hmm.

Long term game. And it's also the Amazon way. Right.

Amazon give you 80% of the functionality. Yep. And, and about 800 announcements when it comes out and, and have at, uh, reinvent, which is always loaded with Absolutely.

com. That'll Work. Still Cyber S-T-I-L-L at C-Y-B-E-R.

We'd love to hear what you want to talk about. And if you are one of my and Mitch's cyber friends, security friends out there, we know we who you are. We know where you live.

If you want to be on the show, we're looking for guests. Okay. And if you're a company, you wanna sponsor some episodes and come on, we're happy to, We're happy to do that too.

So talk, talk, shop with you. But you know, this is, this is what you get. So don't expect That's what, what you're paying for Still cyber after all these years.

Hey Mitch, it's good to be on here. It's good to be back. Hey man, it's been, well, I don't even want to say how long it's been.

Um, enjoy the rest of our tech strong tv. Uh, for the next, this whole week we're gonna be broadcasting live streaming live. And uh, well, you know what, may Mitch, maybe we will try to do a wrap up Thursday.

That'd be good. Oh yeah, we could totally do that. That'd be fantastic.

Yeah. All right. Until then, though, this is Alan and Mitch for Still Cyber after all these years.

Wow. We're out.